More unbounded recursion

[EdwardCooke]

• 4 more classes with unbounded recursion when deserializing.
• Changed default max recursion depth in the deserializer builders to be 100 to allow more headroom for consuming applications.

[Copilot]

🟡 Changes recommended

Depth tracking has a correctness issue in DocumentLoadingState.Nest/Unnest and the new public MaxDepth API needs tightening for safer/clearer behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR introduces depth limiting to the RepresentationModel load path to prevent unbounded recursion/stack overflows when parsing deeply nested YAML, and adjusts the default recursion limit used by deserializer builders.

Changes:

• Lowered the default deserializer builder maximum recursion from 130 to 100 (and updated related XML docs).
• Added a configurable maximum read depth to YamlStream (propagated into YamlDocument) and depth tracking via DocumentLoadingState.
• Added tests asserting that RepresentationModel parsing stops at depth 101 and allows depth 100.

File summaries

File	Description
YamlDotNet/Serialization/StaticDeserializerBuilder.cs	Lowers default max recursion to 100 and updates docs.
YamlDotNet/Serialization/DeserializerBuilder.cs	Lowers default max recursion to 100 and updates docs.
YamlDotNet/RepresentationModel/YamlStream.cs	Adds MaxDepth and passes it into YamlDocument during Load.
YamlDotNet/RepresentationModel/YamlDocument.cs	Accepts a max depth and uses it to initialize DocumentLoadingState.
YamlDotNet/RepresentationModel/DocumentLoadingState.cs	Adds depth counter/limit and Nest/Unnest APIs used during parsing.
YamlDotNet/RepresentationModel/YamlNode.cs	Wraps ParseNode in Nest/Unnest to enforce max depth.
YamlDotNet/RepresentationModel/YamlSequenceNode.cs	Adds MaxDepth and uses it when reading via IYamlConvertible.
YamlDotNet/RepresentationModel/YamlScalarNode.cs	Adds MaxDepth and uses it when reading via IYamlConvertible.
YamlDotNet/RepresentationModel/YamlMappingNode.cs	Adds MaxDepth and uses it when reading via IYamlConvertible.
YamlDotNet.Test/RepresentationModel/YamlStreamTests.cs	Adds regression tests for depth limiting behavior.

Review details

Suppressed comments (1)

YamlDotNet.Test/RepresentationModel/YamlStreamTests.cs:302

• Test method name uses underscores, which is inconsistent with the existing PascalCase naming in this test class.

        public void RecursiveStackOverflow_Allow100()

• Files reviewed: 10/10 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.